# DB crasher

Faraday (faraday@altair.vv.com)
Fri, 19 Apr 1996 13:50:57 PDT

- Messages sorted by:[ date ][ thread ][ subject ][ author ]

    The appending of strings causing a server panic, having just tried to
    duplicate this on my machine using a $prog on a 1.8.p4 the DB increased
    from 2meg to 35 meg in no time.
    It then drowned in lag due to accessing the swap and not even the
    $cu:suspend_if_needed(0) could prevent it from timing it out saving my
    system from a complete system resource exhuastion which I presumed would
    have panicked the server or maybe even crashed the whole machine.
    What this shows did is that the panic reported was more likaly to have
    been caused by exhaustion of resources rather than a server error itself.
    This would seem like a fairly effective way for a malicious programmer to
    either crash a system or to at the very least cause massive lag by
    forcing the DB to expand into swap.
    If placed into a forked eval, it could be almost undectable as they would
    not even be on line when the fork bomb strikes (unless you monitor evals,
    inwhich self deleting verbs could be used).

    Would Pavel concider adding a $server_options property to control the max
    addition length of strings and presumably lists too. This would allow a
    suitably long value to be selected while preventing the forked bombs
    striking, while this might not have been a common method of melicious
    attack in the past that might have been because it was not as commonly known
    as it is now.

    FD.